Feed on
Posts
Comments

Monthly Archive for July, 2021

A short question for management: If an attacker logged on to one of your servers with a stolen admin account last night, would you know? In the incidents I work on, the answer is almost always no. Not because the company didn´t have tools, but because nobody had the full picture. The firewall logs were […]

Read Full Post »

This one is a bit longer than usual, because it is a topic close to my heart after this spring. There are two kinds of SOC. The first one watches. It collects logs, looks at alerts, and when something looks bad it writes a ticket or sends a mail to the customer: ‘We have detected […]

Read Full Post »